What tools and Linux systems are involved inside Docker containers?

Inside Docker containers, various Linux tools and subsystems are used to provide isolation and resource management:

• Namespaces — isolate processes by different aspects: PID, network, filesystem, user IDs, etc.
• Control Groups (cgroups) — limit and control resource usage (CPU, memory, disk) by containers.
• Union filesystems (OverlayFS, AUFS, etc.) — allow creating layered filesystems on which Docker images are based.
• SELinux/AppArmor — security systems that can be used to restrict container rights.

Docker uses these Linux kernel mechanisms to create lightweight virtualization, enabling the running of isolated applications without full OS virtualization.